Markdown Parser and HTML Renderer for Go

Package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML.

It's very fast, supports common extensions and has a CommonMark mode that passes all 652 examples of the CommonMark 0.31.2 spec.

Tutorial: https://blog.kowalczyk.info/article/cxn3/advanced-markdown-processing-in-go.html

Code examples:

• https://arslexis.io/goplayground/#txO7hJ-ibeU : basic markdown => HTML
• https://arslexis.io/goplayground/#yFRIWRiu-KL : customize HTML renderer
• https://arslexis.io/goplayground/#2yV5-HDKBUV : modify AST
• https://arslexis.io/goplayground/#9fqKwRbuJ04 : customize parser
• https://arslexis.io/goplayground/#Bk0zTvrzUDR : syntax highlight

Those examples are also in the examples directory.

API Docs:

• https://pkg.go.dev/github.com/gomarkdown/markdown : top level package
• https://pkg.go.dev/github.com/gomarkdown/markdown/ast : defines abstract syntax tree of parsed markdown document
• https://pkg.go.dev/github.com/gomarkdown/markdown/parser : parser
• https://pkg.go.dev/github.com/gomarkdown/markdown/html : html renderer
• https://pkg.go.dev/github.com/gomarkdown/markdown/md : markdown renderer, see Rendering to Markdown

Usage

To convert markdown text to HTML using reasonable defaults:

package main

import (
	"github.com/gomarkdown/markdown"
	"github.com/gomarkdown/markdown/html"
	"github.com/gomarkdown/markdown/parser"

	"fmt"
)

var mds = `# header

Sample text.

[link](http://example.com)
`

func mdToHTML(md []byte) []byte {
	// create markdown parser with extensions
	extensions := parser.CommonExtensions | parser.AutoHeadingIDs | parser.NoEmptyLineBeforeBlock
	p := parser.NewWithExtensions(extensions)
	doc := p.Parse(md)

	// create HTML renderer with extensions
	htmlFlags := html.CommonFlags | html.HrefTargetBlank
	opts := html.RendererOptions{Flags: htmlFlags}
	renderer := html.NewRenderer(opts)

	return markdown.Render(doc, renderer)
}

func main() {
	md := []byte(mds)
	html := mdToHTML(md)

	fmt.Printf("--- Markdown:\n%s\n\n--- HTML:\n%s\n", md, html)
}

Example source: examples/basic.go

CommonMark

parser.NewCommonMark() creates a parser for the CommonMark 0.31.2 grammar. It's a shortcut for setting the parser.CommonMark flag. All 652 official examples are tested against exact HTML output. The flag is off by default, preserving existing parsing and rendering behavior.

CommonMark mode uses this library's parser and usual ast nodes, so AST traversal, transformation, custom renderers, and HTML rendering hooks remain available. It uses strict CommonMark syntax regardless of the parser's Extensions setting; extensions and custom block/inline parsers apply only when the flag is off. Reference destination and title overrides remain available.

When markdown.ToHTML receives no renderer, CommonMark documents use XHTML tags and no smart punctuation, matching the official examples. To customize rendering, supply an html.Renderer with your own flags.

p := parser.NewCommonMark()
output := markdown.ToHTML([]byte("# Hello\n"), p, nil)

For more documentation, read this guide

Rendering to Markdown

md.NewRenderer() renders an AST back to Markdown, for example to reformat a document or to write one after modifying its AST:

p := parser.NewWithExtensions(parser.CommonExtensions)
doc := p.Parse(input)
output := markdown.Render(doc, md.NewRenderer())

The output parses to the same HTML as the input, with the parser that read the input. It escapes whatever would otherwise be read as Markdown syntax. md.WithRenderInFooter(true) writes link destinations as reference definitions at the end of the document instead of inline.

The output is a normalized form of the input: the lines of a paragraph are joined, emphasis is written with *, headings with # and code blocks with fences. A few things don't round-trip: whitespace that HTML ignores anyway, the leading . of a code block's info string ({.go} is written as go), and emphasis nested three levels deep with punctuation next to the delimiters.

Comparing to other markdown parsers: https://babelmark.github.io/

Sanitize untrusted content

We don't protect against malicious content. When dealing with user-provided markdown, run the rendered HTML through an HTML sanitizer such as Bluemonday.

The HTML renderer has two flags for untrusted input, which reduce what a document can do but don't replace a sanitizer:

• html.SkipHTML removes raw HTML.
• html.Safelink restricts the URL scheme of links and images to http, https, ftp, mailto and relative paths. It doesn't check hosts (http://example.com@evil.com/ is allowed) and doesn't affect raw HTML.

The parser.Attributes and parser.InlineAttributes extensions let a document set HTML attributes with {key="value"}. With html.SkipHTML or html.Safelink, only attributes that can't run script or load anything are kept: id, class, title, lang, dir, role, width, height, align, data-* and aria-*. Without those flags a document can set any attribute, such as onclick or style, so only enable these extensions for documents you trust or with one of those flags. Either way, a document can't replace an attribute the renderer writes, like the href of a link or the src of an image.

Here's an example of simple usage with Bluemonday:

import (
    "github.com/microcosm-cc/bluemonday"
    "github.com/gomarkdown/markdown"
)

// ...
maybeUnsafeHTML := markdown.ToHTML(md, nil, nil)
html := bluemonday.UGCPolicy().SanitizeBytes(maybeUnsafeHTML)

mdtohtml command-line tool

https://github.com/gomarkdown/mdtohtml is a command-line markdown-to-HTML converter built using this library.

You can also use it as an example of how to use the library.

You can install it with:

go install github.com/gomarkdown/mdtohtml@latest

To run: mdtohtml input-file [output-file]

Features

• CommonMark compliance. With parser.NewCommonMark(), parsing follows the CommonMark 0.31.2 spec and the output matches all 652 official examples exactly. See CommonMark.

• Compatibility. The Markdown v1.0.3 test suite passes with the --tidy option. Without --tidy, the differences are mostly in whitespace and entity escaping, where this package is more consistent and cleaner.

• Common extensions, including table support, fenced code blocks, autolinks, strikethroughs, non-strict emphasis, etc.

• Safety. Markdown is paranoid when parsing, making it safe to feed untrusted user input without fear of bad things happening. The test suite stress tests this and there are no known inputs that make it crash. If you find one, please let me know and send me the input that does it.

  Parsing takes time linear in the size of the input, and the output can't grow much faster than the input. To keep it that way, the parser has limits that normal documents don't reach:

  • Blocks and inline content are nested at most 64 levels deep.
  • Once references ([text][label]) have expanded to more bytes of destinations and titles than the size of the document or 100KB, whichever is larger, further references are left as text. Footnotes and references from ReferenceOverride don't count.
  • Once table rows with too few cells have been padded with that many empty cells, further rows only get the cells they have.

  NOTE: "safety" in this context means runtime safety only. In order to protect yourself against JavaScript injection in untrusted content, see this example.

• Fast. It is fast enough to render on-demand in most web applications without having to cache the output.

• Thread safety. You can run multiple parsers in different goroutines without ill effect. There is no dependence on global shared state.

• Minimal dependencies. Only depends on standard library packages in Go.

• Standards compliant. Output successfully validates using the W3C validation tool for HTML 4.01 and XHTML 1.0 Transitional.

Extensions

In addition to the standard markdown syntax, this package implements the following extensions:

• Intra-word emphasis suppression. The _ character is commonly used inside words when discussing code, so having markdown interpret it as an emphasis command is usually the wrong thing. We let you treat all emphasis markers as normal characters when they occur inside a word.

• Tables. Tables can be created by drawing them in the input using a simple syntax:

  Name    | Age
  --------|------
  Bob     | 27
  Alice   | 23
  

  Table footers are supported as well and can be added with equal signs (=):

  Name    | Age
  --------|------
  Bob     | 27
  Alice   | 23
  ========|======
  Total   | 50
  

  A cell spanning multiple columns (colspan) is supported; just repeat the pipe symbol:

  Name    | Age
  --------|------
  Bob     ||
  Alice   | 23
  ========|======
  Total   | 23
  

  A pipe inside a code span does not end the cell, so `a|b` is one cell. Elsewhere, write a literal pipe as \|. This differs from GitHub, where a pipe always ends the cell and \| is the only way to include one; a \| inside a code span is left as written here rather than unescaped.

• Fenced code blocks. In addition to the normal 4-space indentation to mark code blocks, you can explicitly mark them and supply a language (to make syntax highlighting simple). Just mark it like this:

  ```go
  func getTrue() bool {
      return true
  }
  ```
  

  You can use 3 or more backticks to mark the beginning of the block, and the same number to mark the end of the block.

• Definition lists. A simple definition list is made of a single-line term followed by a colon and the definition for that term.

  Cat
  : Fluffy animal everyone likes
  
  Internet
  : Vector of transmission for pictures of cats
  

  Terms must be separated from the previous definition by a blank line.

• Footnotes. A marker in the text that will become a superscript number; a footnote definition that will be placed in a list of footnotes at the end of the document. A footnote looks like this:

  This is a footnote.[^1]
  
  [^1]: the footnote text.
  

• Autolinking. We can find URLs that have not been explicitly marked as links and turn them into links.

• Strikethrough. Use two tildes (~~) to mark text that should be crossed out.

• Hard line breaks. With this extension enabled, newlines in the input translate into line breaks in the output. This extension is off by default.

• Non-breaking space. With this extension enabled, a space preceded by a backslash in the input becomes a non-breaking space in the output. This extension is off by default.

• Smart quotes. Smartypants-style punctuation substitution is supported, turning normal double- and single-quote marks into curly quotes, etc.

• LaTeX-style dash parsing is an additional option, where -- is translated into –, and --- is translated into —. This differs from most smartypants processors, which turn a single hyphen into an ndash and a double hyphen into an mdash.

• Smart fractions, where anything that looks like a fraction is translated into suitable HTML (instead of just a few special cases like most smartypants processors). For example, 4/5 becomes <sup>4</sup>&frasl;<sub>5</sub>, which renders as ⁴⁄₅.

• MathJax support is an additional feature supported by many markdown editors. It translates inline math equations quoted by $ and math blocks quoted by $$ into MathJax-compatible format. Underscores (_) won't break LaTeX rendering within a math element.

  $$
  \left[ \begin{array}{a} a^l_1 \\ ⋮ \\ a^l_{d_l} \end{array}\right]
  = \sigma(
   \left[ \begin{matrix}
   	w^l_{1,1} & ⋯  & w^l_{1,d_{l-1}} \\
   	⋮ & ⋱  & ⋮  \\
   	w^l_{d_l,1} & ⋯  & w^l_{d_l,d_{l-1}} \\
   \end{matrix}\right]  ·
   \left[ \begin{array}{x} a^{l-1}_1 \\ ⋮ \\ ⋮ \\ a^{l-1}_{d_{l-1}} \end{array}\right] +
   \left[ \begin{array}{b} b^l_1 \\ ⋮ \\ b^l_{d_l} \end{array}\right])
   $$
  

• Ordered list start number. With this extension enabled an ordered list will start with the number that was used to start it.

• Super- and subscript. With this extension enabled, text between ^ is superscript and text between ~ is subscript. For example: H2O is a liquid, 2^10^ is 1024. They can't contain spaces unless escaped with a backslash, and \^ or \~ includes the character itself.

• Block-level attributes allow setting attributes (ID, classes and key/value pairs) on block-level elements. The attribute must be enclosed in braces and put on a line before the element.

  {#id3 .myclass fontsize="tiny"}
  # Header 1
  

  Will convert into <h1 id="id3" class="myclass" fontsize="tiny">Header 1</h1>.

  With Attributes, an attribute can also go on the line after the block in kramdown style, as {: key="value"}.

• Inline attributes. With the InlineAttributes extension, attributes can follow a link or an image:

  [docs](https://example.com){.external target="_blank"}
  ![logo](logo.png){width="64"}
  

  For both kinds of attributes, see Sanitize untrusted content for what's kept for untrusted documents.

• Mmark support, see https://mmark.miek.nl/post/syntax/ for all new syntax elements this adds. Table captions (Table: ...) require both Tables and Mmark.

Users

Some tools using this package: https://pkg.go.dev/github.com/gomarkdown/markdown?tab=importedby

History

markdown is a fork of v2 of https://github.com/russross/blackfriday.

I refactored the API (split into ast/parser/html sub-packages).

Blackfriday itself was based on the C implementation sundown, which in turn was based on libsoldout.

License

Simplified BSD License